Reorganized traefik

infra/traefik-middleware/default-headers.yaml

@@ -0,0 +1,15 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: default-headers
+spec:
+  headers:
+    browserXssFilter: true
+    contentTypeNosniff: true
+    forceSTSHeader: true
+    stsIncludeSubdomains: true
+    stsPreload: true
+    stsSeconds: 15552000
+    customFrameOptionsValue: SAMEORIGIN
+    customRequestHeaders:
+      X-Forwarded-Proto: https

infra/traefik-middleware/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: traefik
+resources:
+  - ./default-headers.yaml

infra/traefik/helm-release.yaml

@@ -0,0 +1,63 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: traefik
+  namespace: traefik
+spec:
+  chart:
+    spec:
+      chart: traefik
+      reconcileStrategy: ChartVersion
+      sourceRef:
+        kind: HelmRepository
+        name: traefik
+      version: 31.1.1
+  interval: 1m0s
+  values:
+    deployment:
+      kind: DaemonSet
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+            - matchExpressions:
+                - key: node-role.kubernetes.io/master
+                  operator: Exists
+            - matchExpressions:
+                - key: node-role.kubernetes.io/control-plane
+                  operator: Exists
+    ports:
+      web:
+        redirectTo:
+          port: websecure
+      websecure:
+        middlewares:
+          - traefik-default-headers@kubernetescrd
+
+    providers:
+      kubernetesCRD:
+        allowCrossNamespace: true
+
+    ingressRoute:
+      dashboard:
+        enabled: true
+        entryPoints:
+          - websecure
+        matchRule: Host(`traefik.${domain}`)
+        middlewares:
+          - name: forwardauth-authelia
+            namespace: authelia
+        tls:
+          secretName: ${domain//./-}-tls
+
+    # This is needed in order to properly forward the real ip to each service
+    # There are likely better ways of handling that, but for now this works
+    # TODO(Tim): Figure out how to properly forward the IP
+    # hostNetwork: true
+    service:
+      spec:
+        externalTrafficPolicy: Local
+    # updateStrategy:
+    #   rollingUpdate:
+    #     maxUnavailable: 2
+    #     maxSurge: 0

infra/traefik/helm-repository.yaml

@@ -0,0 +1,7 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: traefik
+spec:
+  interval: 1m0s
+  url: https://traefik.github.io/charts

infra/traefik/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: traefik
+resources:
+  - ./namespace.yaml
+  - ./helm-repository.yaml
+  - ./helm-release.yaml

infra/traefik/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: traefik